topic whitelist and blacklist input in Getting Data In

whitelist and blacklist input

virtualpony — Mon, 15 Apr 2013 21:24:46 GMT

Hi, I am trying to construct an input.conf stanza + whitelist/blacklist rule to look for the following:

accept all **.log* files but specifically ignore
log4j.log, broker.log, somefile.log

This is how the input.conf file looks like right now:

[monitor://D:\ProgramName\logs]
whitelist=\.log$
blacklist=log4j|broker|somefile
disabled=false
sourcetype=newsourcetype

but at the moment it doesnt look like anything is being picked up with this combination. I have confirmed that the universal forwarder has installed this app.

Re: whitelist and blacklist input

JSapienza — Tue, 16 Apr 2013 12:57:33 GMT

Try :

[monitor://D:\ProgramName\logs\*.log]
blacklist = (log4j|broker|somefile)
disabled=false
sourcetype=newsourcetype

Also you might want to review these :

Whitelist or blacklist specific incoming data

Edit Inputs.conf

Re: whitelist and blacklist input

virtualpony — Tue, 16 Apr 2013 18:39:13 GMT

Sorry, this doesn't work either.

Re: whitelist and blacklist input

JSapienza — Tue, 16 Apr 2013 18:55:08 GMT

Well then there is another underlying issue because that is a valid input stanza. Are other files/directories being monitored on this machine and is that data visible from the search-head? Is this a manual deploy or are you using deployment server to push your changes ?